Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 19:00
Static task
static1
Behavioral task
behavioral1
Sample
2a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73.exe
Resource
win10v2004-20221111-en
General
-
Target
2a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73.exe
-
Size
192KB
-
MD5
522879aa7fba4392adf2216d0c076020
-
SHA1
cb14410d84aabbe51bc190bd58340c77e8f0eff5
-
SHA256
2a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73
-
SHA512
9111f95300ca94c3b75e66bcac19dab1fbe543d2099bbe7e2b1e30129753b85ddc8c2953b9fe5156c70cc457a7403cfaffca6d3f6eacd73613c01612b6b39b4e
-
SSDEEP
3072:4ShLIxdvKuGr7t5qCRFSoRQg/yqG9Kf5L/SV5qK:hiVCRFSoRQZC5L/hK
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
2a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73.exevnwap.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 2a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vnwap.exe -
Executes dropped EXE 1 IoCs
Processes:
vnwap.exepid process 1368 vnwap.exe -
Loads dropped DLL 2 IoCs
Processes:
2a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73.exepid process 1836 2a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73.exe 1836 2a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73.exe -
Adds Run key to start application 2 TTPs 29 IoCs
Processes:
vnwap.exe2a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /a" vnwap.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /x" vnwap.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /f" vnwap.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 2a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /b" vnwap.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /k" vnwap.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /a" 2a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /n" vnwap.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /g" vnwap.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /w" vnwap.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /s" vnwap.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /t" vnwap.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /v" vnwap.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /o" vnwap.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /l" vnwap.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /c" vnwap.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /q" vnwap.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /y" vnwap.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /p" vnwap.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /i" vnwap.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /h" vnwap.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /r" vnwap.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /m" vnwap.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /z" vnwap.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ vnwap.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /d" vnwap.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /j" vnwap.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /e" vnwap.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnwap = "C:\\Users\\Admin\\vnwap.exe /u" vnwap.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73.exevnwap.exepid process 1836 2a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe 1368 vnwap.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73.exevnwap.exepid process 1836 2a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73.exe 1368 vnwap.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73.exedescription pid process target process PID 1836 wrote to memory of 1368 1836 2a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73.exe vnwap.exe PID 1836 wrote to memory of 1368 1836 2a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73.exe vnwap.exe PID 1836 wrote to memory of 1368 1836 2a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73.exe vnwap.exe PID 1836 wrote to memory of 1368 1836 2a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73.exe vnwap.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73.exe"C:\Users\Admin\AppData\Local\Temp\2a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\vnwap.exe"C:\Users\Admin\vnwap.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\vnwap.exeFilesize
192KB
MD5522879aa7fba4392adf2216d0c076020
SHA1cb14410d84aabbe51bc190bd58340c77e8f0eff5
SHA2562a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73
SHA5129111f95300ca94c3b75e66bcac19dab1fbe543d2099bbe7e2b1e30129753b85ddc8c2953b9fe5156c70cc457a7403cfaffca6d3f6eacd73613c01612b6b39b4e
-
C:\Users\Admin\vnwap.exeFilesize
192KB
MD5522879aa7fba4392adf2216d0c076020
SHA1cb14410d84aabbe51bc190bd58340c77e8f0eff5
SHA2562a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73
SHA5129111f95300ca94c3b75e66bcac19dab1fbe543d2099bbe7e2b1e30129753b85ddc8c2953b9fe5156c70cc457a7403cfaffca6d3f6eacd73613c01612b6b39b4e
-
\Users\Admin\vnwap.exeFilesize
192KB
MD5522879aa7fba4392adf2216d0c076020
SHA1cb14410d84aabbe51bc190bd58340c77e8f0eff5
SHA2562a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73
SHA5129111f95300ca94c3b75e66bcac19dab1fbe543d2099bbe7e2b1e30129753b85ddc8c2953b9fe5156c70cc457a7403cfaffca6d3f6eacd73613c01612b6b39b4e
-
\Users\Admin\vnwap.exeFilesize
192KB
MD5522879aa7fba4392adf2216d0c076020
SHA1cb14410d84aabbe51bc190bd58340c77e8f0eff5
SHA2562a832bd6121bdcfccf27ee24a0252990a54cdd8b59cd06a151fcdda4a5a9ef73
SHA5129111f95300ca94c3b75e66bcac19dab1fbe543d2099bbe7e2b1e30129753b85ddc8c2953b9fe5156c70cc457a7403cfaffca6d3f6eacd73613c01612b6b39b4e
-
memory/1368-59-0x0000000000000000-mapping.dmp
-
memory/1836-56-0x0000000075771000-0x0000000075773000-memory.dmpFilesize
8KB
-
memory/1836-65-0x0000000073F21000-0x0000000073F23000-memory.dmpFilesize
8KB